feat(github): add release event support for GitHub by zakisk · Pull Request #3041 · tektoncd/pipelines-as-code

zakisk · 2026-10-21T12:02:53Z

📝 Description of the Change

Add support for GitHub release events in Pipelines-as-Code. When a GitHub release is released (via the released action), the controller detects the event, resolves the tag — both annotated and lightweight — to its underlying commit SHA, and triggers matching PipelineRuns.

What this PR does

New trigger type: Adds release as a new triggertype.Trigger constant alongside push, pull_request, and incoming.
Event detection: Extends detectTriggerTypeFromPayload to handle *github.ReleaseEvent. Only the released action is supported; other actions (created, edited, published, deleted, etc.) are ignored.
Payload handling: Adds handleReleaseEvent which:
- Populates event fields (URL, base/head branch, sender) from the release payload
- Matches the event to a Repository CR via MatchEventURLRepo
- Initializes a webhook client when accessed via the webhook path (same pattern as IssueCommentEvent)
- Resolves annotated tags by following the Git ref to the underlying commit object
- Resolves lightweight tags directly from the tag ref SHA
E2E test helpers: Adds CreateRelease and DeleteRelease functions in test/pkg/github/tag.go
Documentation: Updates event matching docs, CEL expression docs, concepts page, and GitHub App/Webhook provider pages

Example PipelineRun annotation

metadata:
  annotations:
    pipelinesascode.tekton.dev/on-event: "[release]"
    pipelinesascode.tekton.dev/on-target-branch: "[refs/tags/*]"

Example CEL expression

pipelinesascode.tekton.dev/on-cel-expression: |
  event == "release" && target_branch.startsWith("refs/tags/v")

🔗 Linked GitHub Issue

🧪 Testing Strategy

Unit tests added

detect_test.go: Tests that released action is detected as processable, and published action is rejected
parse_payload_test.go (8 new test cases):
- Webhook client initialization for release events
- No matching repository CR
- Nil repository in release payload
- Annotated tag SHA resolution
- Lightweight tag SHA resolution
- Invalid Git object type handling
- Error fetching Git ref handling
- Release event without GitHub client (webhook path)

E2E tests added

TestGithubGHEReleaseAnnotatedTag — creates a branch, pushes a .tekton/pipelinerun.yaml, creates an annotated tag with a unique name, creates a release, and waits for the PipelineRun to succeed
TestGithubGHEReleaseLightweightTag — same flow with a lightweight tag

🤖 AI Assistance

I have not used any AI assistance for this PR.
I have used AI assistance for this PR.

AI was used to help write unit tests, E2E tests, and documentation. All code has been reviewed, understood, and validated by the author.

✅ Submitter Checklist

🤖 Generated with Claude Code

pipelines-as-code · 2026-10-21T12:03:34Z

Paco Review 🔍

This PR adds GitHub release event support to Pipelines-as-Code. It introduces a new release trigger type, a ReleaseBody field on the event struct, a handleReleaseEvent function in the GitHub provider that resolves tag SHAs (handling both annotated and lightweight tags), a getMarshalledReleaseBody helper, and the corresponding documentation updates, unit tests, and E2E tests.

Review difficulty: 4/5 (Hard) — The change spans multiple layers (trigger types, provider payload parsing, custom params, webhook bootstrap, CLI, docs, and E2E tests) with non-trivial tag-resolution logic and a new YAML-marshalling approach for the release body template variable.

4 new inline comment(s) found.

_{Reviewed commit: 98b06f5}

pipelines-as-code

Paco inline comments -- see the Paco Review summary comment for the overview.

codecov · 2026-10-21T12:04:59Z

Codecov Report

❌ Patch coverage is 89.65517% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 91.97%. Comparing base (1d2b8aa) to head (e92193b).
⚠️ Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/provider/github/parse_payload.go	90.38%	5 Missing ⚠️
pkg/params/triggertype/types.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3041      +/-   ##
==========================================
- Coverage   91.98%   91.97%   -0.01%     
==========================================
  Files         167      167              
  Lines       12965    13025      +60     
==========================================
+ Hits        11926    11980      +54     
- Misses       1038     1044       +6     
  Partials        1        1

Flag	Coverage Δ
unit-tests	`91.97% <89.65%> (-0.01%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copilot

🟡 Changes recommended

Unresolved event setup, authorization, and payload handling gaps prevent supported release workflows from running.

5 open issues

Add release events to generated bootstrap manifests · New
Subscribe CLI-created GitHub webhooks to release events · New
Populate DefaultBranch from repository payload · New
Authorize GitHub App release events · New
Resolve nested annotated tags to their commit · New

What changed in this PR

Adds GitHub release events to Pipelines-as-Code so matching PipelineRuns can execute against released tags.

Changes:

Adds the release trigger, action filtering, and tag SHA resolution.
Adds unit tests and end-to-end tests for annotated and lightweight tags.
Documents release matching and GitHub event subscriptions.

File	Description
test/pkg/github/tag.go	Adds release creation and deletion helpers.
test/github_release_test.go	Tests release pipelines for both tag types.
pkg/provider/github/parse_payload.go	Parses releases and resolves tag SHAs.
pkg/provider/github/parse_payload_test.go	Tests release payload handling.
pkg/provider/github/detect.go	Accepts the `released` action.
pkg/provider/github/detect_test.go	Tests release action filtering.
pkg/params/triggertype/types.go	Defines the release trigger.
docs/content/docs/providers/github-webhook.md	Adds release webhook subscription instructions.
docs/content/docs/providers/github-app.md	Adds release App subscription instructions.
docs/content/docs/guides/event-matching/cel-expressions.md	Adds release filtering examples.
docs/content/docs/guides/event-matching/_index.md	Documents release annotations and supported actions.
docs/content/docs/concepts.md	Lists release as a supported event.

_{Review effort: Balanced}

Copilot

🟡 Changes recommended

Missing default-branch metadata prevents release pipelines from loading definitions when default-branch provenance is configured.

2 open issues

4 resolved since last review

_{Review effort: Balanced}

zakisk · 2026-10-22T05:24:52Z

/paco review

pipelines-as-code

Paco inline comments -- see the Paco Review summary comment for the overview.

Copilot

🟡 Changes recommended

Release-body substitution can prevent PipelineRun decoding, and the new webhook tests lack the repository setup required by CI.

2 open issues

2 resolved since last review

_{Review effort: Balanced}

theakshaypant

Only went through the docs so far, will do another walkthrough of the code

theakshaypant · 2026-10-22T05:37:53Z


 Using block format avoids validation errors and keeps your YAML properly structured.

+### Using the release body


[question] is there a limit on the size of the release body?

don't know but I guess there is no such limit

Asked this as I was thinking of cases where release_body is used and is LONG, could that cause any issues with creation of the object. For reference, found this test which checks for the max length of an object.

I don't think that anyone would add that much release notes but yeah as it's newly added feature we will see if reported we can revisit it

theakshaypant · 2026-10-22T05:55:10Z

+
+Both annotated tags and lightweight tags are supported. Pipelines-as-Code resolves the tag to its underlying commit SHA so that the PipelineRun runs against the correct source.
+
+Only the `released` action triggers a PipelineRun. Draft releases, pre-releases, and other release actions (such as `created`, `edited`, or `deleted`) do not trigger a match.


We should also add the published event here IMO.
I confused between the two, given that released docs mention "a release was published" :|

actually released mean when you're really making a release available for others, published can be a pre-release, or a draft release but release mean this is really released (too many releases 😄 )

Haha, yes I understand the distinction now :P

[nit] I was suggesting explicitly add that published action as not supported even though we have draft releases, pre-releases not being supported.

Add support for GitHub release events in Pipelines-as-Code. When a GitHub release is released, the controller detects the event, resolves the tag (both annotated and lightweight) to its underlying commit SHA, and triggers matching PipelineRuns. Example PipelineRun annotation: ```yaml pipelinesascode.tekton.dev/on-event: "[release]" pipelinesascode.tekton.dev/on-target-branch: "[refs/tags/*]" ``` Changes: - Add `release` trigger type and detection for `released` action - Handle webhook client initialization for release events - Resolve annotated tags via Git ref API, lightweight tags directly - Add E2E test helpers (CreateRelease, DeleteRelease) - Add E2E tests for annotated and lightweight tag releases - Document release event matching, CEL expressions, and webhook setup Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Zaki Shaikh <zashaikh@redhat.com>

theakshaypant

Question (again) about the ACL for release events.
tektoncd/pipeline uses a robot account to do releases, how would a pr be triggered in such cases? Or is an account being able to publish a release = enough permissions to trigger a pr

zakisk · 2026-10-27T11:47:44Z

Question (again) about the ACL for release events. tektoncd/pipeline uses a robot account to do releases, how would a pr be triggered in such cases? Or is an account being able to publish a release = enough permissions to trigger a pr

@theakshaypant I don't think that would be an issue because E2E test is also makes the release with github app creds and its working

zakisk · 2026-10-27T16:15:31Z

@theakshaypant I think you're right I have found an issue with github app creds but don't whether it will be the same as with bot account

zakisk · 2026-10-27T16:34:46Z

@theakshaypant I had to add my github app bot username in OWNERS to run the e2e, but it's responsibility of pac deployment owner to give appropriate permissions

pipelines-as-code Bot added the paco/review-moderate Paco review difficulty label Oct 21, 2026

pipelines-as-code Bot reviewed Oct 21, 2026

View reviewed changes

Comment thread pkg/provider/github/parse_payload.go

Comment thread pkg/provider/github/parse_payload_test.go

Comment thread test/github_release_test.go Outdated

chmouel requested a balanced review from Copilot October 21, 2026 12:07

Copilot started reviewing on behalf of chmouel October 21, 2026 12:08

View session

Copilot AI reviewed Oct 21, 2026

View reviewed changes

Comment thread docs/content/docs/providers/github-app.md

Comment thread docs/content/docs/providers/github-webhook.md

Comment thread pkg/provider/github/parse_payload.go

Comment thread pkg/provider/github/parse_payload.go

Comment thread pkg/provider/github/parse_payload.go

zakisk force-pushed the SRVKP-15075-support-gh-release-event branch from dbb0a3a to 7a51eee Compare October 21, 2026 12:15

zakisk requested a balanced review from Copilot October 21, 2026 13:49

Copilot started reviewing on behalf of zakisk October 21, 2026 13:52

View session

Copilot AI reviewed Oct 21, 2026

View reviewed changes

Comment thread pkg/provider/github/parse_payload.go

zakisk force-pushed the SRVKP-15075-support-gh-release-event branch 3 times, most recently from c8d4685 to 98b06f5 Compare October 22, 2026 05:22

zakisk requested a balanced review from Copilot October 22, 2026 05:24

Copilot started reviewing on behalf of zakisk October 22, 2026 05:25

View session

pipelines-as-code Bot added paco/review-hard Paco review difficulty and removed paco/review-moderate Paco review difficulty labels Oct 22, 2026

pipelines-as-code Bot reviewed Oct 22, 2026

View reviewed changes

Comment thread pkg/provider/github/parse_payload.go

Comment thread pkg/provider/github/parse_payload.go

Comment thread test/github_release_test.go

Comment thread pkg/provider/github/parse_payload_test.go

Copilot AI reviewed Oct 22, 2026

View reviewed changes

Comment thread pkg/provider/github/parse_payload.go

Comment thread test/github_release_test.go

theakshaypant reviewed Oct 22, 2026

View reviewed changes

zakisk force-pushed the SRVKP-15075-support-gh-release-event branch 4 times, most recently from 5cf1cf9 to df68e9b Compare October 26, 2026 10:11

zakisk force-pushed the SRVKP-15075-support-gh-release-event branch from df68e9b to e92193b Compare October 26, 2026 16:34

theakshaypant reviewed Oct 27, 2026

View reviewed changes


		Using block format avoids validation errors and keeps your YAML properly structured.

		### Using the release body


		Both annotated tags and lightweight tags are supported. Pipelines-as-Code resolves the tag to its underlying commit SHA so that the PipelineRun runs against the correct source.

		Only the `released` action triggers a PipelineRun. Draft releases, pre-releases, and other release actions (such as `created`, `edited`, or `deleted`) do not trigger a match.

Conversation

zakisk commented Oct 21, 2026

📝 Description of the Change

What this PR does

Example PipelineRun annotation

Example CEL expression

🔗 Linked GitHub Issue

🧪 Testing Strategy

Unit tests added

E2E tests added

🤖 AI Assistance

✅ Submitter Checklist

Uh oh!

pipelines-as-code Bot commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Paco Review 🔍

Uh oh!

pipelines-as-code Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov Bot commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

zakisk commented Oct 22, 2026

Uh oh!

pipelines-as-code Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

theakshaypant left a comment

Choose a reason for hiding this comment

Uh oh!

theakshaypant Oct 22, 2026

Choose a reason for hiding this comment

Uh oh!

zakisk Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

theakshaypant Oct 27, 2026

Choose a reason for hiding this comment

Uh oh!

zakisk Oct 27, 2026

Choose a reason for hiding this comment

Uh oh!

theakshaypant Oct 22, 2026

Choose a reason for hiding this comment

Uh oh!

zakisk Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

theakshaypant Oct 27, 2026

Choose a reason for hiding this comment

Uh oh!

pipelines-as-code Bot commented Oct 21, 2026 •

edited

Loading

codecov Bot commented Oct 21, 2026 •

edited

Loading

zakisk commented Oct 27, 2026 •

edited

Loading